win:powershell 169
Remote Connection
- Log source
- PowerShell logging
- Host type
- Windows (workstation, member server, domain controller)
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
- Note
- The source names this ID on this channel, but the channel documentation does not list it. Kept as the source states it.
Why this tier
NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Recommended | NSA |
| Windows member server | Recommended | NSA |
| Windows domain controller | Recommended | NSA |
| Windows web server (IIS), internet-facing | Recommended | NSA |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | PowerShell Activities: Remote Connection |